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A TI FN TION: Board of Patent Appeals lind hiU'rfcrences 

APPi- .\L BKiKF (37 (\F.R. § 4 1.37 > 

Thi-i bncl" IS in fiiitliiMfjiKC oi' the Nioiicc oi' .Appeal filed m thfs case on 0.>/09/2007, and in 
icsponse to the decision on the Petition i'oi Withdianal Abandontneni, mailed 0*-). l*-)/200S. 

the tecs rcqLined tijulej 1 I", and anv required petition fvi e\tt,asion of time foi fiimg this 
bnef and tet-*^ theiefui ate dealt with in the accompainiag IRWSMUrXl Oh \P?t\l 
BRIEF. 



1 iiis hnef oontam.-> tbcse nen^ undei tite foHowiiiL: headm^is and ni the oid>.i set lortii Klow { ^'^ 
rPR ^^^11 ^"(cHO) 



iu:al p\Rr\ i\' iMPRPsr 

RhL \ rfcD APPh ALS KSD IN FhRFhRHNC fcS 

SI \irS0F CI AIMS 

STATUS or AMFNOMfNTS 

SUMMARY 01 <1.A1ML1)SI BJF( 1 MMIFR 



M (^ROi'NDSOF Ri'Jf<llO\ FO BF RI \ Si WFDON \PPI \L 

Ml \RG1 Ml \T 

\m C L UMS \Pi»l'NDL\ 

i\ I\lUr\(l \PFF\l)I\ 

X Rfi ATmpnot rrD!\(j \pprMD!\ 

I he final paiic of this bnei beai& the practitumei .ijgnatuit; 



I REAL PARTY IN INTEREST (37 C.F.R. § 41.37(c)(l)(i)) 

llie real part>' in imefest in this appeai is McAfee, hic. 



O RELATED APPEALS AND INTERFERENCES (37 C.F.R, § 41,37(c) 



With respect to other prior or petidmg appeals, interferences, or related judicial proceedings that 
will directly affect, or be directly affected by, or have a bearing on the Board's decision in tire 
pending appeal there are no other such appeals, interferences, or related judicial proceedings. 

A Related Proceedings Appendix is appended hereto. 
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m STATliS OF CLAIMS (37 C.F.R. § 4K37(c) 

A. TOTAL N UMBER OF C LAL\LS J \ AFPLKLATrON 

Claims in the applicauon are: i, 2, 9-14, 21-26, iind 33-37 

B. STA i tJS OF Al-L TM E CLA IMS IN APPLIC: A HON 

1 . Claims withdrawn from coiisideration: None 

2. Claims pending; 1 , 2, 9- 1 4, 2 1 -26. and 3 3-3? 

3. Claims allowed: None 

4 . C la j ms rejected : 1 , 2 , 9 - i 4, 2 1 -2 6, and 3 3 - 3 7 

5. Claims cancelled: 3-S, 1 5-20. and 27-32 

C. CLAIMS ON APPEAL 

The claims on appeal are: C 2, 9-H., 21-26, and 33-37 



See additional status information in the Appendix ofXManra. 
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to lUe "itatus (if anv anieiidnitfiit tlktl .^ubsfiiiiein to tlnal rtieotma the Xintmlment suhnmted 
on }0 }2 200*^ vva-^ tiot cntcncd b\ the fc xainme md ihc XmctulniCTU subnuUvd on 07 2 4 200(i 
was einered bv the Exanuiier. 



\ SIMMAR\ OF (I \IMFDSI BJF.iT M \rJFR f37 ( .F.R. §41-37(cHlK>)) 



Wuh itfppect to a 'Siimmaiv m'dann 1 as shown in l-juiites 2 4"^ and (■> et al a compute! 
piogtani puuifict cinHodicd on a tangihie compute! loadable medium i*^ pnnidcJ thai is opciabio 
in conJioi A coinputci (l g ^cc uem 200 oi ^lt^^lK' t etc ) to is^ue an <i1ch Tot an oti{~of-d<Hc 
update stauis ofd inah%aie .scanner I he LOinputci ptoyrani punhict coinpiise^ (i) teadmy itiyn. 
that IS opeiable lo lead an update =tams ftek! ie ^ see uem bf> of I iL'uit; 4 eic } as<;ociaied with a 
conipntt'i file {c a ^oe ncrn M of Fiuutc 2, item '^U of V-iyuu- 4 item "4 of htiure ^, or^ ) to be 
^canned h\ a cuticnt malwase sLannoi whcic the update statuo tleid tc, nHiK-ati%e of an update 
status of a pjesious inajuaie seannei tijai has scanned die coniputei Jiie ant! assoLiatcd the 
update status field witii die computet fds. AdditsonalK the computer progtam pioduct 
compusts U!) coiTipatjson loujc that so vipeiablc to compato the update status of the pre\iou^ 
nuduare -tannc! with an update status ot l\w cuiicnt raaiwate scannei, as as (u\) alcil 
i>suuK' iogic thai Ks opetahle if die update status of the cuTieTit uialwaie scannei does not match 
the update status of the pivMiUis mah^aIe .scaunet lo Lssue an updatt .status alett mdicah\e of an 
out-of-date tipJato status f<>i vvhuhcxci otie of the cuticnt nialwatc .scannes and the ptcMOUi 
inaKxatc .-,cannei lias a most out-of-date update status 

1 uiihc! the compmei progjam ptochtct compusc^; {!\} changt h^iggtttg loaic that i<; opetahie to 
!o2 citange.s to tite ttpJato otatiis field to cieate a chantic hi«>i0i\ m an update statu;> ttacktng 
database te g -ec itein !6 of Fitjure 2 etc ) to enable idenidlcatfon of \\eaknetises within update 
.status management based on the change hi.stvisv Furthei ^tdh if the curTcnt malwate scatinet has 
a le^s out-of-date update staitis than the preMtau-. iTiaKsare scannet then the upd<ue status field 
a^ssociatej with the cotnputer file i*^ changed to correspond to the cuncnt maiwatc i>eannei 'VFso 
the update .-,tatus aleit nicludes uuc ot mote of a u<et alett that is issued cmi wiuche\et otie of 
the cuiient nudwaie scanuet and tiie pie\'ous nalware scannei has a most out-of-date update 
status and (n) an admtnisttatoj aleit that is issued to an adnumstratoi ot \\lnt.be\et one of the 
current malwaxe scanner and the previous mahvare seatiner has a most out-of-date update status. 

in addition li theie is no the update stanu as^t\-jated wuh the coinputci file at a fnsi malwaie 
seaniung then the update status field is yeneiated and associated wiih the i_otnputeT fde and the 
update status ttackmg database i.s updated Juitheunoie. the update siatu;> field is mcluded 
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within an update suilus file {e.g. see item .^d of Figure 2, item 68 of Ftgore 4, etc.) passed 
logeiher and associaied with the co?nputer file beiweefi imilwate scanners. Puriher siill, the 
vtpdate status file and the computer file are combined into a combined file (e.g. see item .^8 of 
Figure 2., item 72 of Figure 4, etc.) that is passed as a single entity between the malware 
scanners, and the conibined file is a file compressed combination of the update status file and the 
computer file. See, for e.Kampie, Page ?>, lines ! i-24 and 34; Page 4, lines 1-2, 12- 16, and 18-24; 
and Page 9, lines 25-28 ei al 

With respect to a suvntnary of Claini 1..^, as shown in Figures 2, 4, .5, aiid 6 ei ai., a coniputer- 
.in.ip!e.rnented inethod perfonned v^'ith cornputer code embodied on a langibie eompiuer readable 
medium is provided for alerting an out-of-date update status of a mahvare scanner. In use, an 
update status field {e.g. see item 66 of Mgure 4, etc.) associated with a computer file (e.g. see 
itetTi 34 of Figure 2, item 70 of Figure 4, item 74 of Figure 5, etc. ) to be scanned by a current 
malware seamier is read, where the update status field is indicative of an update status of a 
previous mahvare scaimer thai has scanned the computer file and associated the update status 
field with the cotnputer tile. Add-ttionaHy, the update status of the previous malware scanner is 
compared with an update statirs of the current malware scanner. Further, tt'the itpdate stains of 
the currem mahvare scanner does not match the update status of the previous Tualware scatmer, 
then an update status alert indicative of an out-of-date update status is issued for wdtichever one 
of the current malware scanner and the previous malware scanner has a tnost out-of-date update 
status. 

Further still, chaitges to the update status field are logged to create a change history in an tspdate 
status tracking database (e.g. see item 46 of Figure 2, etc.) to enable identification of weaknesses 
within update status ntanagemeot based on the change history. Also, if the citrrent ntalware 
scanner has a less out-of-date update status than the previous mahvare scanner, tlien the update 
status field associated with the cornputer file is changed to correspond to the curreTit tnalwaTe 
scanner. Additionally, the update status alert includes one or triore of (i) a user alert that is 
issued on whichever one of the current mahA-'a.re scanner and the previous malware scanner has a 
most out-of-date update status, and (ii) an administrator alert that is issued to ati administrator of 
whichever one of the currein .ntalware scanner and the previoiis mahv are scatttter has a tttost out- 
of-date update status. 
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la ddd\hon if tbcie is uo ihe update stdtus dsMciatjJ \s tth the Lumpulej file <H a fust raalH^je 
scanning then the update status ileiil is eeneiattd and aswciated \Mth the compiittt file and the 
update status {rat^ktUL: database is updated Hathcimoic, the update '■-tatiis t1eid is nuUidcd 
\\ithin an ujidate statu.-> file (eg ueni '^b of Figuic 2 item of rsguit. I etc ) passed 
ttigethei and .i^souiatcd %\nh the eoinputei Jiie het\scet! inalwaie stv)aneu^ Ftmhei still the 
update status file and ihe computet Jjie aie combnieJ nito a ut>mbined file {eg see tiem ?8 of 
Fmutc 2, Item 72 of Figure 4 etc ) that k-, passid as u smgk- entit^v bet\\et.-n the malware 
seanneis and ihe cotiihined file is a Jile Lonipre^-sed cottthtnation of the update status t'lle and the 
computer file Sec ioi exantple Page 3, !tne ^4 Page 4 lines 1-2 i2-lO, atid iS-24 Page 5 
Hues li-23; and Page 9, lines 25-28 et al 

With icspci^t to a siinimau uf Claun 2"^ as si^n\n ui Piguies 2 4 and n tt al an apparatus 
nitkiduig a t.ingihle computer leadahie tttednmi is punided ioi rssmng an aiert fui an t)»t-oi~date 
update status ut a niaK\aje sLamici Ihe appauiais compnscs u) <i ii.adt.r thai 1 1 ^peiabL to lead 
an update status tkdd te g see item f'O ot higtire 4, etc \ associated \Mth a computer tiie te u .soe 
Item ^4 of I iguie 2 stent "U of Ftgute 4 item 74 of I tgute ett > lo be st.antied In a cuiient 
niaiuaie scannei wheie die update status field is tndji,att\e of au update status oi a piuxious 
maKvttc- scantwt that ha<; scanned the compute file and aswctated the update status fieid wtth 
the comp'-i^^^' i^'s \dditiona!h the appaiatus i.t.)nipuses tn) a contpatitoi that is opctable to 
ennipare the update status of the pscMous lUdK^ate statinei with an update status of the eunent 
mai\\atc scanner \ uiiher, the apparatUo compitse^ <,ini an alert is^uei that is operaMe it the 
update <;t3ius of the cuiieni mal^^are scannei doe*^ rtot niatvli the update statu'^ of tlii, pte\unts 
maKvaie tj^aanei to issue an update i>tatuij alert that is mdicatne of an out-of-date update- status 
lor whichever one oi tlic cuttenl maiwaie sLatniet and the preMtaio maiware scannei lias a tuost 
out-of-date tipdate stattis. 

1 ufiliei siiil the appaiatus eompiises (i\ ) a changt logger that is cipeiabk to kig changes to the 
update status field to euate a change hictors m an update status tiacknii.' database (e a see item 
4<i of Figuie 2 etc ) to enable ickuttltcatum of weaknesses witlitn update ciiatus management 
based ou tliL diange lu<;toi\ Also iftlie cuiteni ntalware scannei ha-> a ie<ss out-ol-date update 
status than the pt^MOus maluate scanner tlun the update status tie Id ass<>t.iated with tite 
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Lomputot [i\c is oliangcd to 0(Mtc\poiui to the (.itncDt nuiiuarc Ncatmct \dditu>ndlK {be u\x\:xiv 
staitis jik'it includtfs one ot luoit; of u) a usei dien ib.u is issued on s-\lyt.be\e} one of the euueni 
n'i.-iK\.i{c: scanne! and tiiL piesiODs inahsaie .?canoi.i has a mosi (nu-oi-date update ^laiu'^ and {u} 
an adinimst} au>t alert tSiat i-^ issued to an aJiinn sti^noi ot'whiche^ei one of the cunent mal\\aio 
scannei and the jirexjuiis niahxaie seannei ha^ a most out-of-date updafe stan^ 

hi addition if thetu ts no the updattr .status as<^t ciat*,d with the Lomptitei fde at a fust malwaie 
scanning then the update status field is yenciattd and assoeiated with the compiitei file and the 
update status iiat-kuiy database updated Fuithetntote the update status ftetd uti hided 
\Mthin an upiiate status ille (e y see neni '^b of Figtiie 2 neni 68 of hyure 4 ute ) pas'^ed 
totiethei and apsoctated \\nh the >,0i7ipiitei Jde bet\\e*,ti ntahsate scaiinets Ftuthet stdi the 
update status file and the computet file aic combmed uuo a cosiibsned file (e i. ^ee item '^f^ of 
FiL'uie 2 ueiii 72 of figuio \ etc ) that is passed as a single emii\ between the maluaie 
scauneis and the i^on^buied Siie is a tile tonipiessed eonihiuatton ol the update statu^ fde and the 
computer file See foi example Paiie ^ iutc U Paye 4 hues 1-2 12-10 aud iS-24, Page *^ 
line 25-Page 6, litie 3: aiid Page 9, lines 25-2S et al, 

(;)f course, the above citaiiorts are merely examples of tire above claim hmguage and should t^ot 
be coiistmed as lirriiting in any manner. 
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\ I GROl NOS OF RFJKC T!0\ TO BE RF \ IF.\^ ED ON APPEAL (37 C.F,R, § 
4I.37<c)(I>{vi» 

Follow ing. under c-acb i.ssut lifted, is A concise statement settinu fonh the corresponding around 
of rejection. 

issue f- \ : The Examiner has objected to the spfCillcayon as failing To provide pruper anieccrdent 
basis for the claimed subject martei. 

hsue ^ 2. I he F.vnniner has rejected Cl^hm 1-2. ^)'!4. 21-26. and ^'^~:■^7 imdet ( ■.S.(\ \ \2, 
iirsi paragraph, as failiou to compiy with the \\ritten desciiption requirement. 

Issue - -v- The Rxanuner has rejected Claims 1-2. ^?-!-4. 21-20. and .^-3- 17 under 3^ U S C 101 as 
being directed towards non-statiitory subject matter. 



i he claim'; uf tin. gu>ups noted heiu\s do noi itaiul ot tal! tos^ethti In the pte'^ent sei-uon 
appellant e\plains \\h\ the claims of caci> Liroup aio helie\cci tu be scpautofv patentable 

issue f?- 1 : 

Ihe bviininer has obioetcd to the spoeific^nion as taihng to pioxide piopct anttvedent baMs i\n 
the clatnted subject tnattet 

specitUalK the l-xaminei ha-^ asc;ejt(.d that '!e]auh mdependent claim has been amended to 
include at lea<^t the pbta-^e 'twni^iihSe computei readable medium'" and that ^'nowhese m the 
spec! Ik rf} inn this piira-^e disclosed Appellant disasiiees and icspeLtliiUv atisetts liiat Paiie 1 1 
imes 1 1-15 of the spet^ificaiion disL loses Lonijjutet pufuam uiptraetiona that nu\ be stoied m 
t>nc- or nwic of the random aecc-ss mcntoi) 204 the lead <inh miTUurN' 20f> arid the baid diak 
drive 210" (eniphasis added), ail of wiiich are computer readable mediimis. 

■issue # 2: 



rbc txatninei has tejecttd Claims 1-2 ^'-14, 21-2o, and 33-?'' under 35 L S C\ 112, ftrsr 
paiapaph. as fading to compK with the wiuten dei>enption lequtiemcnt 

Group #./; Ciaims ./-2, 9-i< 2i~24, and 37 

With respect to Claims 1-2, 9-14, 21-24, and 37 the Examiner has agairj asserted that "'[ejacb 
independeiu claim lias been amended to incUide at least the phrase 'tangible eonipuier readable 
medium"' and that '■nowhere in the speeiDcation is this phrase disclosed.'' Appellant again 
disagrees and respectfully asserts that i-'age ih lines 1 3- 15 of the speciilcaiion discloses 
"computer program instructions that may be stored in one or more of the random access tnemoiy 
204, the E'iid.oilly..ll).v^t)lo^^^^^ 206 and the haj;d^itsk.drive 210"'' (emphasis added), all of which are 
computer readable mediitms. 
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( 71 (Hip '2 { V 25-2(^ -vni 

Wuh sesf'tjct n> (laniT^ 2 ■^-26 and 33- i-ie l-xanunei h.A<^ auasn as<;ti{ed th.tt jejach 
independent ciaun b;\\ been .^mended fvi mcSude «t least die phia^e "taivAibie ^ompuier jeadabie 
nicdmin"'' and diat 'nowberc sn tbt? NpeLitlcatton is thi^ pbiase disclosed" Appeilan? agani 
dfsagjecs and lespcciiulK a^^cit^ ihiM Page 11 bne.^ 1>-1^ of tbc specification Jiscitiscs 
"compute! puiiifam in^tius-tson-i tbat uiaN be stoied n\ one oi moie the landom aecess uiemors 
204 tbc lead onl> menK>t> 20(> and tbc hard disk dme 2i0 (emphasis added) a!l ot ubich are 
coiiiputer readable mediums. 

in die Office Action mailed (.U/09/2t}07, the l^xantiaer has responded to appei lam's above 
argument by arguing tbat "Claims 25-26 and 33-37 purport to be apparatus claims., but appear to 
be iackifig aa essential element under 1 12, 2"'', to support the preamble and make them apparatus 
claims^' (see page 5, paragrapli 1 of tlie aforementioned f)f.fice Action). .Appellant assumes that 
tins argujnent by the Ir;.\aminer refers to the above .^5 l;.S.(;'. i 1 2, first paragraph rejection, which 
is addressed above. 

■issue # 3: 

The Exaniiner has rejected Claims 1-2. 9-14, 21-26, and 33-37 under 35 Li.S.C, lOi as being 
directed towards non-stattitory subject matter 

Group HI: Ckiims I~2, and 9-12 

With re.-,pect to Claims !-2 atid ''-12, she Lxantmct has aigued diat the ' contputei ptoi/iam 
ptoducf as claimed b\ appeliaiit '~is just the softuaie piece and fads to nn-lud^e the phv^ijcal 
aUicic or ob)eL{ as die meduim uhich establisliLS the s{atutur\ categui\ ' \ppellant disagiees 
and lespvL-tftHK points out diat independent Ciatm i nKludcs ' Ltimpntei pKigiam piodtiLi 
embodied on a tangible computei teadahle medumi (empha$!^ added), as clamicd 

hi addition the F^aminci has aigued tijat Clasms 1-2 atid ^-12 fai! in prnduee a useinl eonojete 
and tangible tesuh in the mstance \^hen th,. update status ol the eunem inahsaie scannei mat>.hei 



- 14- 



thc update st^nus o{ ihe pte%u^!!s i5)nh,\ote SLatr.ici SpectrioalK the Fxaininej ha^ aigiteti that 
ihe lAcuniner 'has ie\itfued the" rum! lesuit di.5iie\ed foi each nmdiltoti co\efed, boih those 
iiLUjaiiv ieoited and ihvAs ccneied .aid not recued and ci-ncludc^'; that ^ji|i\iiiv [condmonj tadjs] 
to bo a useful concicte, and tai\mhie icsidt ihei? the claim-' ate psopeiK lejceted under ^5 1' S C 
H)\ " The rxfinmicr goes on to attiue that 'Vlaim ! does not piodute a ibcinl, tunticte, and 
tangible ie^nlt m the instance when tbe npdaie --lains ofthe cuiteni niaiw^ite seannet inaJehes the 
update otalus of lUe pie\ iOu& mah\aie ^cannej 

in addnion in ihe Otftee \i.t\oxt niaded I 00 20D7 the bvanunei has agan\ leueiated that 'these 
is no nseiui LuULiele and tauuibie Jesuit w iien tbe update status of the pie\iou^ seatinet is the 
same as the update sfatus ai the cttirent s>,annei and that i s\ jhea these statuses aie the s<uiie the 
uni\ stcp'^ bfinu perfojmed aic teadniL: and compannL: and eieath these dv not result in a useini, 
concrete, and taiigible result." 

Appciiani lespectfuih disayfees \tki (.aieiid je\ie\i of ^'^ I s ( HM andtlie icknant scctiuns 
of the Mi'fcP, appellant taiK to find am ^uppoit fot tine hxammers as^eition titat '| Qf an> 
t.ondition| ladf-^j to ix^ a usetid, etinetete and tangible ic$idt, [uheiltet tn nc^t tecued m tiie 
clauns i then diL elanns aie piupeiix lejeeted nndet '^5 {' SC jOl ' (emphasis added) E uithet 
appellant te<;pectfull\ a<;st,rts that the claims (Ve not hmited to a smiation \\hete 'the update 
status of the Lunent mal\\aic seannei matches the update ;>iati!S of the prcssons nialvxate 
scannei " as noted hv the f^annner, and tiuis a ! election based on sucii iansiuaoe eieaih 
improper. 

\ppe1Uim agam pi'nit:^ can that independent Ciaim ! docs punide a u.^-efuK concrete and tanaibie 
lesnlt Foi cNampie appellant claims m part. Mien iisunig it>gic opeiabfe if said update stains 
of said cuiiciit malwaie scannet doe> not match said update slants oi said pte\ious maluaie 
icanner to issne an update siaius aiert jndjeaij\e ol an out-ui-fiate u})date -status loj whiciiexei 
(.>ne of said i^ifireut uiah\aje sLamitt aiid oavl piexiou^ maKsare scaimei has a most out-uf-date 
update statu:^ ciiange loi^gnig loiiic operaiiSe to log thange^ to ^aid update status tield to cieare 
a eliange bistou in an update status ttai-knig daiaba^-e to enable identdieauxni of weaknesses 
wnhm update statu«; maitagement leased on the change hi'5tor\ w iterem it said euttent maluase 
scanner iias a less out-of-date updats. status tiian ?aid piesious maiware seannei. tki.n said update 
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status flcid a:ssoo!a{ed wnh scitd Oi^niputei file citaitged to ^onc$pond io vnd cottenf nutKvrtic 
SLanoci uheieni, ifihere !s no >akl update stuas assoojdied wnh ^dK\ i_otnpu{e{ hie Ji a iksi 
n'i.-iK\.i{c: scanning, then 'said update status field \.-, generatt^d aud assui. sated \Mth said computef 
fde, and said update .status tiacKuiu datahaoO h updated ' (emphasis added}, as ciauned In fact, 
m ifKiepeiKieiu Claim 1 appcUaiU cUniiis a "tonputei ptot;ram pioducE t.'rabodicd on a taug^bic 
muiputci icadabie uiednun ope! able to conmil a conqnuer in issue an alert loi an oiu-ol'-datc 
update status of a ma]\sare scanuei " {emphasis added) as claimed, which clearh is a useful 
concrete and tangible result. 

Therefbre, based on the Mmitations in Claim 1, as highiighted above, it is clear that a usefiil, 
concrete and tangible result is evident. 

( mmp ff2: i ^kums J3~I4 ami 2/ -24 

The LxaiUiuei has aii:ued that ClainLs l.'-!4 and 21-24 fail to pioduce a useful omcrete and 
tangible result in the instance when the update status of the cunent malnaiL- scanner matches the 
update status of the pre\ tous n)ah,\are scanner SpeeificalK. the Txannner ha.^ aigued that 
■ eiaini \ ?> does not appeal to produce a uscfu! concteto, and tangible lesult tn the instance uhen 
the update status of the current iiialware scanner matches the update status of rlie pre\ lous 
maiware scanner." 

in addition in the Ottlee Action niaded I 00 20D7 the I vanuiiei has agant leiieiated that 'thcic 
is iK) iiselul LuULiele and tangible tesuh when the update status of the pie\ious scaTinei is the 
satne as the update status ot the (.urrent ^>.annei and that '^^]hen these statuses are the same the 
onK steps being pettottned an. teadnig and conipaimg and ckatK these do nt>t tesult ni a Uvelul, 
concfete and taiigtble ksuU ' 

\ppvi!ani iespectfulh disagrees Xfici caieful ie\ic\i ol ^'^l s( HM and the icle\ ant sections 
ot the MPfci', appellant fatic lo fina an\ cupptnt tot the fcxammn s abci\e asses t!t.>n that 'jilt ani 

condition] latlf^j to be a usetul ctinctete and tangible u'^-uk [uheihe? tn nc^t recued m tiie 
claims then the clainis ate piopetK lejected imdei T S C ICtT (emphasis added) Fuithci 
appellant lespeciiulK asserts that the claims aie not limited to a situation ^\heie ' tlii. update 
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status of the cunent infjlware seamier matches the u{xl£Ue status of die previous nifilware 
scanoer.'" as noted by ihe Bxaraifier, tind duis a rejectioa based on such language is cieariy 
improper. 

A^npeiiaiu rfddiUonallv pumtv, out thai liidcpL-ndwif C Umi i ^ does pitnide a UNcfu! toncietc and 
tangibie K-isidt r<n o\ainplt\ appelkuu v-lanus, m pail if b.Jid update staUi^ of satd cnrrenT 
inai^ate scannei does not match said update .-.tatu'^ of vaid pte\!ous mahvaie scannei ihen 
isMiuii; an update status alert ioaicatise ot an out-of-date updati- status foi v'vhichcsc! one of ^ald 
LUiK'Ut malwaie scanner and said ptcx'ous nialuaic scannct ha^ a mun oui-oi-daie update 
*^{-itfis lu u.uHi.u t-haii.ue> to >aui update siatus fu-id to eicaiL a change hi-^toTN hi an update status 
tiacking database to enable identification ot we.iUov.'^ses sMtbtn update statu'^ Uianagenient based 
on the chaniie hjvtois whctcin ff ^asd cunent malwait- scaanci has a i>,<-s out-uf-dato update 
stauis dian laid picMOu^ malwate scanner, ilien -aKl update .status flclJ associated vMth said 
Loinputci llSe is ch.utued to eoae^pnnd to ^aui ciineni mahx ate scannet lieiem if there is nu 
said update stains asso(.kued with s<nd coinpntei fdc at a fust m<d\\<ue scannmu then said update 
status field IS generated and acsti^uUvd \Mth said eomputei h\c aud said update statuo traeknig 
database is updated" (oniphasiN add(.dK as cianned hi laet in uidependent Claim I > appellant 
elamis a LOinputej-inipiemenied ineLh<u1 peiloiaied \s itli eoniputeT code enibfuiied on a tangible 
cotiiputei leadabie nKdiuin foi alertinu an out-of-date update statin of a maiwatt <;cannef 
(emphasis addcdl as claimed whwh cieaiK is a useiul eoneietc and tangible lesuh 

Theictoie based on the limuatiou-, ni ( laini at. htghliuhted <ibo\ e, it ts clear dial a nselul, 
concrete and tangible result is evident. 

Gnwp 1)3: Ciairm 25-26 and 33-36 

\f)p^l!ant .ig.nn notes dial ihe 1 \ainirei has aigued that ( lamis Z^-Zo and '^'^-^1 piirj^oji to lie 
appasatiis d^am-^ hui appeal lo be lackuie an e~,stntial ekment undcf 112 2 lo snppoii the 
preamble and make them appatati)^ tlaim^" and that |"a]s ^uch thL\ app^at to be mercA 
lOttwate {function il Je.-^utptne mat(.tial) pci ^e and noii-statuton undei ^'^ i SC 101 lathei 
than an actual appatatus Vppeilant asiiunes that thi= argument In the i \aimnef K\ets to the 
abo\ e ^^ I S C 112 ilfst pai agiaph le ect.on w iiKh is addre ^sed abov e 
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Additioualh the P ^afunjci has aiuued ih'M Ckum^ 25-3<') and ^V^6 faii ttf ptoducL- a usefiii 
i^uiicitfte Aud langible lesiih tn the uj.?t;mt.e whtru {he update sutUi^ oi the cuuent nwhsaie 
scanntM matches the update -natus uf the pte\Jous malwaio -xMiinoi SpccUkalK the b\anisnc{ 
h.is otL'ucd that ' [e]i<iini 15 a!.->o appeal^ to ha\c the ^ame i^suc c>f tlaJin \ <md tlaim H 
ieg<!uimg the coDdiliona! natuie of the +uial lesuU <:itbie\ed 

Fuithci m the Office Action madcd I U*-' 20()"7, the t-\aniinei hti^ atrain icitcuited rhat "theie is 
no useiiii, (.ont-iete, and tangible tcMxh uhen the update status of the piexjous scannei is tiie 
same a^ the update status <'>{ die ciitieiu si^anuet ' and thai jhen these statuses aie the same the 
onl\ oteps bemii petfouDed are ieadmni and >,onipanng md cleaii\ these do not lesuh m a liselid 
conc!Cte and tangthk' lesult " 

AppcllaiH tespectJuiU disagiees AStei caietui teMcu or"^"^ ( Si" 10] dtid the lelevaTU set-tions 
of the \iPl.P appdlaiu fads to fmd atn suppoit fot the IXainnur s aho\c a^scftfon that ^'[t jf an> 
"conditKm] faij[.s"| t(> bo a uscfu! coiiciete, and tangthiu re:r>u!t |"v\hL-Thct or not toenod m the 
ciannsj then the (.lamu-^ a;e [)iope;H lejeeted undei ^-S 1' S C 101" (cmphasJS added) rijulier, 
appeliant respectful!\ assctis that the clanns a.e not Innued to a snuaiu>n where 'the update 
^catt!'; of the ctirrcnt nuK%are scannci matche<i the update -status ot tht piv\tou^ mah%are 
seanneu" as noted bx the Lxamniei atid thus a rejection bassd on ^iich language ts cleailv 
improper, 

Appeliatit additionally points out that independent Claim 25 does provide a usetiii, concrete and 
tangible icsult for exantpL appellatir cUum^ m pait 'an aiett is^uei opotahL- jf .--atd update 
itatns of said ciuient mal\\a;e scanner does not match said update status of siud pJCMOijs 
nuiluare scanuei to issue an update status aicii mdicatno ol an out-of-date tipdato status lot 
whicheAer one of laid (.iirrent niaK\aie si^aniiei and said pies tons TuaK^ale "^eannei has a most 
out-of-date update status a Lhanyc jogeei opeiahie to log change-^ to ^iid update siatiis fieid to 
cieate a change histoi\ m an update statuc tiackmg database to enable idcnttiitation of 
w eaknessc-^ wuhni update statu.-^ niauas/ement based on the ciiange histor\ wheiem if sa'd 
ouitent niahvaie >cannei Ita'^ a less out-oi-date update status than said piesinus nialwate scaunei 
then said update status field associated 'Atth said computei tile ts changed to conesp<>iid to said 
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LUiK'iit mciKxcito $c\)i)uci uheRin li there k-> mf said update ^td^l)^ .bsociatcd with -.rt'ci 
compmer iile at a tnst fujlwaic scanning then s<nd update staai-> Hiild eeneKUcd and 
.i-^st-nattfd uith said compute fde and said update st^itus tiackmg database is updated' 
{■cmpha^}'^ addfd), a.-> tlajmed In fact m mdependtnt ( kmv 2"^ appeliani dmm an 'jajppaunus 
nicludnig a tan^ashle conipuier teadaMc niedmni foi isbinni^ an akit foi an tn)t-of-date update 
.st.ittih oi a raaluate sLannef teniphasi^ .iddcd) as claimed whidi cleaih is a tjj.ehiL conciete 
aod tangible result, 

Theiefotc based on dte htntUJttons m Clatm I'^, as InghbgKted abo\e it ts cleai that a useliti, 
concieto aiui tangible lesuli is e\ideju 

Group ft4: Ciaim 37 

Appcilaut notes that the I xannnet bas aigiied that Umi\ p\iT\)<ni\s\ lo be [au] appataius 
^cbtimj, inn appeai[jij to be lackmi; an es.sential ektnent undet 152 2'"' to .suppuit the pttaniblo 
and Jiiakc fCUura ^7 an] apparatui> fciaimf and that '"l^h sitLb, [C lanii }~] appoaifs] to he 
inctoK softwaic (Junctional dcsLifptue luatenah pci <e, and non-$tati)tot\ undct S C 
rather than an actuai apparatus/ 

\ppcliant lespcotfuHs assoits that CLun) ^'^ ci^atls clamB "'|a| t.t.'mputOi piogtam piudiict ai> 
eianned in cbun^ 1 , wlierLin said update stains aleit tnutieis an automatic update to ^aid maluaic 
hcannei in accoidance wttl) one oi adininustiatv^i ptcrcjenee.-- and ii^ei pieteiences" (emphasis 
added), as claieted, and clearly does not "purport to be [an] apparatus [claim]," as stated by the 
Examiner above. 

Tunhennoie apjK'liaiu lespetttulH a^setts that m Clann ^7 as dependent upon independent 
Claim 1 a luelul t.oni.iete and tangibie tesuh ts esuient fo! the Teasnns atgiied with Te^peet to 
indepcndciu C!am! 1 ni issue - ^ Gioup 'i 

In \iew of the reiuarkfe set forth hereinabo\e_ all of the independent claims are deemed 
aliowable. aiong with any elait^s depending therefiom. 
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VI O CLAIMS APPENDIX (37 CF.R. § 4137(c){l){vili)) 

llie text of the claims involved in the appeal (along with associated status information) is set 
forth below: 

I {Pic\ iouj-K Presented} A compute! piogjam ptodutl embodied on a tangible cnmpiiter 
leadabk niedjum opes able lo contioi a compuier to ismsc an aleiT foi an out-of-date updatcr status 
of a inaKsare scanner said eomptuet piotiiam product compusniLi 

(i) feaduig logic opetabie to fead an update statu-- field assoctated \uth a cojuputet file to 
be -jcanned b\ a t-unent niaK\aie scanner said updatj statu-, Held beniu tndti,att\e ofan update 
stat^is oi a pre\jon.s maU\aie scannei tliai ha.? cfCcnued said ctMiiputei Hie and as.-,ociated said 
update statu<^ field w nh <aid Cvimpufei tlie 

U5^ eoniparj^on Iuizjl opciablc lo compaie '.aul update status of said pK\!oub malwate 
scaunei wnh an update status oi s.ud cunenr oiaKvaie ^tannei 

(ui) alc-n issumi; I'^^yi*- opeiabje d\said updait staius of said Luttent rnahvate scannv.! doe.-, 
not matth said update status of said piexjouc, malwaic jcannei to issue au update status aL-it 
nidicaiue ol oul-of-dale update status for \\h)cbe\ei one of said imrem maiwate scanuet and 
said pjeuoiis nialuaie s(.annei has a niosi out-oi-datj updatL status 

{w ) change iOi^guii: logic opciable to log changes to <;aid update status field t<i ctcate a 
chanue histors m m update statuo tiacku^g database tt.) enable !de«tification of weaknesses 
\\ithin update stattn liiauagenieiis. based oti the change histou 

\sheieni if sdid Lurreut malware ^canuei has a lebs oui~ot~daie update statu^ than ^aid 
pie\ ious raaluase scaonei theii sskI update stati..-, field associated h ith said compuier fde is 
chaiiged to eorre spend to caid cun cut iiiabvare ccanneu 

whereu) said update status a!en meUides 'ine oi moie oi 

ti) a uscf aleu issucti on whti.he\ei one of said current mahAare stantrci and said pio\itius 
inaKxaio >cannei has a niosi out-of-date update statui and 

(u) ail adininistiatof dieii issued to an admmi.->tran)i of \ihiehe\cr one of said Littietit 
maKvaie scanner and saidprcMous maiwaie scanner has a most out-ot-datj update status, 

whereu) if dieie is iio update siatus as-,ociated w idi sdid computet tile at a -^Itst 
nialuaie SLanuuig tbc-n satd update statits Jield i- getieiarcd and associated with ^aid computet 
file and said update sutus tiackmg database u? updated. 
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wheieu) vitd update ■^tuus add is iiKinded withm an upilatc status file jws^ed tt)gethct 
'M\d assoLUitod SMlh said compulef fde bet v\ ecu fndls\dic scanneis, 

\sheteiii Said update status ilie and .?aid corap\ittrt Hie are combined uno .t combined fiie 
thai is passed as a sinLik' cntus between said nia!v\ato ^cannos 

whctcm biud conibtned fde a fde conipiesi,ed conibtnatK>n ofsatJ update ^UitUb fdc and 
said computer file. 

2. (Original) A computer program product as cktmed in claim I, wherein said update statos field 
is incliided as a property field widiin said computer tile, 

3. - 8. (Cancelled} 

9 {Oiiimul) \ comptuet ptouram product as i^laimed in claim ! ■\\hetetn -,aul compiuei fde is an 
e-i.na.il attachmeni. 

iu iOimmali \ computei pu>gi;tm product ai? clannod ni clattn 1, vhcicin said cmtent maluato 
icannei and said piex lou.-^ niaKx ate soannet ate pait a licted nialv\atc scanner 

\ 1 tf Vjginali A computet pioytam product as ciaantd tn olami 1 whefun said tipdate <:tatus 
field iiiciudes one or more oi: 

ti) a mahxate ^cannei (^omputci pI^\t!:Ianl pioduct idemd'tei, 

(u) a vonipiuci hauiwaie identitiei 

iu\}R scannei engme piouram serston identifier, aud 

{n ) a maKxaie defmitti>n data \t'ic.ion idcrititict 

12 tPieviotisIs PicsLMited) A Ci^siiputci piourasn piodiici as claimed m da\m 1 wheiem saui 
itiaKxaio scanner ■^fr\t's to dett;(.t one ui more of 

(i) a computer virus: 

(15) a ! roian ctniiputer program 

(ui) a wottn i-omputct ptos/iatn 

(iO J banned i^oiiiputei ptogtam and 
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(\ } banned coiuciit wnhm a e-iiiad 

I > tPre\u>usls Psesetued) \ computi^i-iniplenjented uiethod peifoTnied \^i{h comptuet code 
embodied nn a taimibic computei readtiblc mcduini fot alcaiaii an OLU-of-date update status csf a 
nuiluare scannct v'lid metlioJ (^ompn^mt; 

iL'ading <!U upddle otdius tieid a^oOChiteJ with a tumputcj fde to be -,^edancd b\ a cuuctn 
inaKsate <;caiint;i ?aid update status field b^tng jodiuatn*, oi ,m upd>3ie status <.vf a }Ht.\ioiiS 
maKsait' scanner that has ^canned said ;,omputci tik and a^^ociated s^iul update status field \s !tb 
said conipoter fik: 

^tmipanjiu sjid npdast; status oi i.yd pic\ toii^ tnahsaie scdtjuci \Mtb an update status of 
said curretn: malware scaoner: 

ft said update status of said tuirent malwait scanner doc^ not nutih said update status of 
said p5e^ am^ m<t\\\d\L seannci, then issuing an update 'tatus aleiT nidicaint. oi an out-of-date 
upd.ife st.iftis Un uhKhe\ci one ol saui cunent mah^aie s<.atiuei and said pit?\50Us uialuaie 
sLannci has a most oui-of-daie upd<iic status, and 

k>t;ging cbaniics to i>aid update status t'leid lo cicatt. a change histors m an ttpdate otatui 
tiaektng database to enable identi^K-at-on of ^^eak5^essc''- within update status ntanas/cment based 
on the change histon': 

wherein if satd current mahsare scannci ha<; a less out-of-datt ttpdate -status than said 
piex tous malvxaic ocannei then said update staii ^ iitld aSsi.n.iated v\ ith ^aid t,omputer file ts 
changed to toiie^poud to satd i^unent mabAaic s<,annei, 

\sheieni said update status a!en 'Ucludes me oi nioie of 

(i) a usei alett isstjedon ^^hicile^el ou^ of saui cut tent iTiaiw ate scaiinei and ^aid pii,\ioiiS 
maKvaie scanner has a tnost out-ot-date update :^tatus and 

(li) au adntnustiatot aiett issued to an adininisttaiot oi whtchevct onet>{ said cunent 
nialuare scannei and said pte\ious nuduaie scannet iias a most oui-ot~daie update status, 

\sheieiu if there is tto said iipdate -.tatus associated w idi ^aid cmuputei Sde at a fust 
malwatv si^annuiy tht-n said update status held i ^ L'tnetated and assjLiated \\ith said compiit^-t 
tile and said update status tiackma database to updated 

whereit) satd update status ;ie!d !s UKhided widnn att update status file jjas^ed tt)gethet 
attd associated sMlh said eompuiet fde betv\een mal\Aaie scannets 
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wheicit) satd update ■^tuus hIc dud vj'd coajputoi iWc au oonthtned imo d LOinhntcd Wlv 
ihat IS passLd as a wwJc sntuv htiiwccii said nialw.ue ^o^mncl ■> 

\sheteiii Said combined iiitr !s a iiif comprised combinanon oi -,au} upd.^te '^t.^tus tlie and 
said computer file, 

!4 {ih fLMiuU) \ molhod as cLumcd in L'iami 1 3, w heieiu srfid update stanus fleki u inclfided as a 
puipeitv iieid sMtlun said comptiter tile 

15.-20, (Caticeiled) 

21 , (Original) A method as claimed in claim 13, wherein said computer file is an e-mail 
attachment. 

22 {( inLMikU) \ Uielhod as cLunwd m lLuiu 1 3 heieiii said mireut nwKsare scannei and saul 
{.nc-\50us malwaje ■^canue^ are pan ofa ticied uwh\aie .->c<mnfii 

2^> (Oui/inai) \ mclhod as <.!aiiued iii ciann M iiercin said update stauis ficfd nicUidcs one or 
more of: 

{1} a maiuare jicannei computer piogiam pioduct idenntiei 
in) a coniputci hard\^alc ident'tieu 
Un ) a scannei engine piotjiam \eri,ion jdcnUlk'i and 
{v-);i raaluate detuiUion daia \ci>iijn idenuflei 

2-^ iPicxKUisls PiCseiitcd) A nivihod as (.iaimed m clami i3 w hei ens said nsalw ate scanner 
serves to delect one oi mote of 

U) a computet muis 

(u) a j Toi'm comiputei piogianj, 

(ui ) a woiiu (.umputei piogiam 

{n ) a banned computer piogram, and 

(\ } banned content wiihm a e-mad 
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2^ (Pic\iousl\ Ptesenit'dj \pp-»atua ftsciudtng a laugibio c omputet jeadabic jucdiuni i^n 5-,vUing 
'M\ a!e!i toi 'An ouf-oj-dais upJaie stauis ot d ijudwafo scaooiit saki appafatus Lonipiisiny 

{!) a ieadei upeu-iMe tv ie^id an update staUK fidd <i<isi>t. sated vvith a conipuiei tile to he 
scannt'd b\ a cunont maK\a!0 scanner saal update ■=;iatus flcid beuiy !nd!cati\c oi\\n update 
stauis oi a picvious nuduare Ntfinsict that has scanned saul conipoKi ilk and <issc>t.!atcd satd 
update status ik'id u uh ^aid coniptutM tde, 

(u) a iompaufoi iipeu-thie to compare '^aui updat*, status of said pies iow^ uiahsaie "^canaei 
s\fth an update status of saal cutuut maK\au- scanner 

iui) an aleii is,-,uof opeiable ffsaal updafc statu ■> oi --aui ouneni in.\\\\ sumnei does not 
nkU(.b said update status oi said ptesuuss niahsare seannet to ts^ue an update status alett 
imbcative of an out-of-date update, siatifs for \shich\,\*,i one (jf >aui cuttetu inaKsaje "^cantiei atid 
said p!e\ fous niah\ar<, ^tannc! lias a most out-of-date update statiis asid 

{n j a thaiisie logger operable tu log chaiigcs to said update status field to CKate a thantie 
histnis m .in upd.itc st.itus tiaekujg database tu enable ideutdkation oi weaknesses xsirbni update 
static mauas_euient bajied un die (.hanye iu.stnn, 

wherein, it :3a5d current maSware st^annei has a k\ss out-of-date update status than said 
prex K>us itiaKxaie seannei then saul update states tleld a->soc laied u !th said t-cvmputet itk 5s 
changed to conespuud to said (.uueni nja!v\aic scanner 

whcreitT <;atd update <;tatus aicit uk hides one ot mote of 

( 0 a usfi alcu issued on whichevei one oi said cuTieni malwaie scantu'i and said pre\ tous 
nuiluare scannet has a most out-of-daie update status and 

tn) an admuiioUatoi ak-U losiicd to an adniimstiaioi of whithexci one of said eutieni 
maiwaie <;caiinet and said pit,\.tous niaiwaie scatai\,i has a mo'it oui-of-daie tipdate suttu'^ 

wherein, it diere is nt> said update status a$sot,iated w ith said compute! file at a thst 
inaKxate .-,caiutnig, dten said update status Held u geueiated and assoi^iateii with said (tutjputei 
ille and s^id update status tiackmg database is updated 

wheieni said update status tkdd !s nx-luded \siduij an update statu-, file jiassed ttfgetbet 
and assuv^iated >\ith said (.umputei fde between niaU\aie scanncis 

wherein said update ^tatus fik and c.aid cornputei fik' are combined into a combined file 
that H pas,-,ed a-^ a .-,ingle ent!t\ between said ntalsxaie scanneis 

whoiein >a!d combined file is a file compiessed combination of satd uptlate status file and 
said computer file. 
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26. (Original.) Apparatus as claimed in. claim 25, wherein said update status field is included as a 

propefty field witliiii said computer file. 

27. ~12.fCancelIed) 

33. (Original) Apparatus as claimed m claim 25, wherein said computer file is an e-.mail 
attachnieot. 

34. (Original) Apparatus as claimed in claim 25, wherein said ciinent malware scarmer and said 
previous malware scanner are part of a tiered rnaiware scanner. 

35. (Original) Apparatus as claimed in claim 25, wherein said update status field includes one or 

more of 

(i) a malware scanner computer program prodnct identifier; 

(ii) a computer haixiware identifier; 

(iii) a scanner engine program version identifier: and 

(iv) a malware defmition data version ide.ntifier. 

•><) (F(c\ lOusK Piesented) apparatus ^is clanncd in claim 2^^, whcicsn said mahsarc scannct 
serves to detect one or more ot: 

(i) a computer virus;, 

(u) a Tuijau compute! pioeiam, 

(in) a worm computer program; 

(n ) a banticd com[HUi.i ptuuuim atid 

{\) banned content \sitliin a e-mad 

(I'jcsiOusK Pjesentc'd) A compiuei puigiam piodut.1 as claimed ar claun 1, ''Aheieui .-.aid 
update status alcu tni>i:cis an auttmiatic update fo said malnare iLanuct m accordance with one 
of administrator preferences and user preferences. 



IX EVIDENCE APPENDIX (37 CF.R. § 4137{c)(l){Iv)) 

lliere is m such evidence. 
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X RELATED PROCEEDING APPENDIX (37 C.F.R. § 4l.37(c)(l)(x)) 



N/A 
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iii the c\cn{ <i lelepbouc Oi^n\e;\alioi5 wouki expedite the prosccouon of tiuci apphciuum, tiic 
[ x;i!unit;i nun itjach the uiidcfsigutid ai <40?!) ^'''"l-2^?3 ! oj (>fi\ mcot oi am iKidiUonal lees due 
in comicjctiun \%ith ihe fihng of this papc;i. the; ( onimLisionei js auThtm/.ed to i.baige such fee.^ tu 
UepoMt \ccoimt\n (Oidci No N'\ilP-!'>S) 



Rt\spect ful ! \ su biuutoti 
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